Health Minister Chris Hipkins warns "there will be consequences" after the secret identities of New Zealand's 18 active COVID-19 cases were leaked.
He has launched an investigation to find out if the leak was deliberate or human error - and says whoever's behind it could face possible criminal charges.
Eighteen active cases have been caught in the quarantine net but when it came to keeping their information secret there was a snag.
The patients' names, their dates of birth and contact details were sent to several media outlets. Not even the patient in Auckland City Hospital was spared.
"Somebody clearly had it who shouldn't have had it. If it was a malicious act, then clearly there will be consequences for whoever did that. It is not okay," Hipkins said.
National too says the leak is "unacceptable" - but blames the Government for it.
"Government had been struggling to join information up where people had had tests or not had tests, and the Government didn't even know about it," National Health spokesperson Michael Woodhouse said.
"Now we know that the information they did have, they could hardly keep secure, and that's highly unacceptable."
The Ministry of Health regularly reveals the sex of confirmed cases, their age group and where they've flown from. It also shows the facility they were staying in when they confirmed positive, and if they've been moved to another facility like the Jet Park hotel near Auckland Airport. But the ministry does not reveal any other identifying details.
The Privacy Commissioner is yet to receive any complaints from the COVID patients, but was told of the leak on Friday.
"It is concerning. You know it's hard to imagine more sensitive information than people's health information and that shouldn't be circulating in the way that this document clearly is," Privacy Commissioner John Edwards said.
Hipkins has asked the States Services Commission to investigate, so he isn't pointing fingers just yet. However he says the information is mainly in the hands of staff at managed isolation facilities.
"The chain of people who could have had access to this information is not an unlimited one," he says.
National says it isn't them.
"I have absolutely no knowledge of the information or how it got into the public domain," Woodhouse said.
The Government hasn't contacted the COVID patients but is apologising through the media.
"I unreservedly apologise on behalf of the New Zealand Government," Hipkins said earlier today.
A baptism of fire for the new Minister of Health, fronting the latest COVID controversy.
